CVE-2018-14709

CVE-2018-14709 affects Drobo 5N2 NAS (Dashboard API) where insecure token generation allows authentication bypass. Public details in the provided documents indicate remote command injection via the NASd service, enabling attackers to perform actions such as querying device status, installing appl...

CVE-2018-14701

CVE-2018-14701 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/delete_user endpoint. It allows unauthenticated attackers to inject and execute system commands through the username parameter, with reported impact of potential full command execution on the device. Public expl...

CVE-2018-14701

System command injection in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14702

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14695

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14704

CVE-2018-14704 affects Drobo 5N2 NAS (firmware around 4.0.5-13.28.96115) with a cross-site scripting vulnerability in the MySQL API error page. The issue arises from unsanitized data in the error page, allowing a remote attacker to execute JavaScript via a malformed URL path. Public references (N...

CVE-2018-14706

The vulnerability CVE-2018-14706 affects Drobo 5N2 NAS with DroboPix, endpoint /DroboPix/api/drobopix/demo, on version 4.0.5-13.28.96115. It is a system command injection via a crafted POST payload to that endpoint, allowing an unauthenticated attacker to execute arbitrary commands on the device ...

CVE-2018-14706

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14696

Drobo 5N2 NAS vulnerability (CVE-2018-14696) due to Incorrect access control in the /mysql/api/drobo.php endpoint. Affects Drobo 5N2 NAS version 4.0.5-13.28.96115. Allows unauthenticated attackers to retrieve sensitive system information. The connected sources confirm the issue and the affected c...

CVE-2018-14695

The CVE-2018-14695 entry concerns Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is an improper access control in the /mysql/api/diags.php endpoint that allows unauthenticated users to retrieve diagnostic information via the name parameter. Public references note impact as exposure of diagn...

CVE-2018-14698

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14703

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

PT-2018-12673

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboAccess/delete user" endpoint, allowing unauthenticated attackers to execute system commands via the username URL parameter...

PT-2018-12680

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue is related to incorrect access control in the Dashboard API, allowing attackers to bypass authentication due to insecure token generation. Recommendations For Drobo 5N2 NAS version...

PT-2018-12667

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/drobo.php" endpoint, allowing unauthenticated attackers to retrieve sensitive system information. Recommendations For Drobo 5N2...

PT-2018-12670

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboAccess/enable user" endpoint, allowing unauthenticated attackers to execute system commands. This is achieved via the username URL...

PT-2018-12668

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting that allows attackers to execute JavaScript. This is achieved via the "username" variable in the "/DroboAccess/enable user" endpoint. Recommendations F...

CVE-2018-14697: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter...

PT-2018-12672

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue is related to incorrect access control in the "/mysql/api/logfile.php" endpoint, which allows unauthenticated attackers to retrieve MySQL log files. This is achieved by manipulating...